A 26-year-old Cuban residing in Galicia, known on TikTok as Estibito, shared a cautionary tale on Tuesday about how a text message scam left him with an empty bank account shortly after his arrival in Spain about a year ago.
In a video uploaded to his TikTok profile, Estibito recounted the incident that began with what appeared to be an official SMS from Correos España. The message claimed that his package could not be delivered due to address issues.
The scam was effective because it perfectly matched Estibito's circumstances; he was indeed expecting a package and lived in a hard-to-find location in a small town. "I was waiting for a package, and then I get this message from the post... it said my order couldn't be delivered because they couldn't find the address," he explained.
Upon clicking the link in the message, he was directed to a counterfeit website designed to mimic Correos Express. There, he entered his banking information. "It takes me to a Correos Express page. A yellowish page, all those things, and suddenly it asks me to enter my details again... shortly after, they charge one cent from my bank account," he recalled.
This minimal charge seemed like a reasonable penalty for reshipping the package, not arousing his suspicion about what was to follow.
While he slept, the fraudsters made their move. "In the middle of the night, as I'm sleeping, I hear the phone, €20, €20, two withdrawals of €20 taken from an ATM... and then suddenly, bam, they withdrew the rest of the money from an ATM in Barcelona," he recounted.
Checking his Banco Santander account revealed the grim reality: "The bank account was at zero, family, zero, zero."
Although he quickly filed a police report and canceled his cards, the bank did not reimburse the ATM withdrawals. He only managed to recover between 40 and 50 euros related to fraudulent online purchases. "Unjustly, they kept the money, and I was never able to get it back," he lamented.
This type of fraud, known as smishing, became one of the most widespread scams in Spain by 2025, with thousands of cases reported. The scam operates in three phases: sending a bait SMS, capturing data through a fake page, and executing the theft via ATMs or online purchases.
Challenges for New Immigrants
Newcomers, particularly immigrants, are especially at risk. Estibito highlighted this vulnerability: "There are many hackers, many inventors, many tricks, those we're not used to seeing in Cuba. Because in Cuba, we typically don't keep money in bank accounts; we hold it in cash."
This specific vulnerability among the Cuban community when facing Spain's digital banking is a recurring topic among those sharing their adaptation experiences, where managing cards and online accounts is a daily routine from the outset.
In response to the wave of scams, Spain's Ministry for Digital Transformation approved measures in February 2025 to combat smishing. By May 15, 2026, new regulations blocking the use of spoofed Spanish numbers from abroad were enacted.
Estibito concluded his story with a stark warning for other Cubans arriving in Spain: "Never click on any links, never answer calls from unknown numbers, never give your information to anyone you don't know, no matter what promises they make."
Understanding and Preventing Smishing in Spain
What is smishing?
Smishing is a type of scam where attackers send fraudulent SMS messages to trick recipients into revealing personal information, such as banking details, by directing them to a fake website.
How can immigrants protect themselves from smishing in Spain?
Immigrants can protect themselves by never clicking on links in unsolicited messages, verifying the sender's identity, and being cautious about providing personal information online. It's crucial to report suspicious activities to authorities.
What measures has Spain taken to combat smishing?
Spain's Ministry for Digital Transformation has implemented regulations to fight smishing, including blocking the use of spoofed Spanish numbers from foreign sources, effective from May 2026.